Privacy Policy

This Privacy Policy describes how the company that operates PhotoSnap Plus ("PhotoSnap Plus", "we", "us") processes personal information in connection with photosnapplus.com, the PhotoSnap Plus dashboard, the PhotoSnap Plus website editor, and the PhotoSnap Plus API (together, the "Service").

For personal information about account holders and visitors to photosnapplus.com, PhotoSnap Plus is the "controller" under the EU and UK General Data Protection Regulations ("GDPR") and the "business" under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). For photos that a business sends through the Service about its own customers or visitors, PhotoSnap Plus acts as that business's processor or service provider (see section 15).

Contact for privacy matters: us through Contact Support in the dashboard.

Photos reach the Service through Bulk Edit and Edit a Photo in the dashboard, through the website editor a business places on its own website, or through the API. For each individual photo, the photo is held in the server's volatile memory only for the duration of processing (typically about one second), is returned to the sender, and is then discarded. Individual photos are not written to disk, temporary files, logs, caches, background job queues, or backups. Bulk Edit retains finished photos only in the user's own browser.

Where a business submits a ZIP archive of photos to the API for background processing, the archive is encrypted on receipt, and each original and finished photo is stored encrypted in our database solely until processing completes and the results are collected. Each original is deleted once processed; all remaining photo data is deleted once the results are downloaded (which is permitted once) or 24 hours after the job finishes, whichever is earlier. These photos are excluded from backups, logs, and caches, and are accessible only through the submitting website's site ID. Thereafter we retain only aggregate job counts.

We do not use photos, or any data derived from them, to train or improve machine-learning models. All models run on infrastructure we control; photos are not disclosed to third-party artificial-intelligence services. See section 14 for how faces are handled.

We collect the following categories of personal information, from the sources indicated:

• Account information (from you): name, email address, and password, which is stored only as a salted one-way hash; whether and when your email address was confirmed; the date your account was created and last signed in.
• Team information (from you and from team administrators): the teams you belong to, your role on each, the team you last selected, and invitations sent to or by you, including the invited email address.
• Configuration (from you and your team): presets and their settings, websites and the site IDs issued for them, and, for up to 30 days, the website addresses that recently called each site ID.
• Transaction information (from you and from Stripe): for each purchase, the number of photos, amount, currency, date, purchaser, and Stripe reference numbers; the team's billing email; and the team's remaining photo balance. Payment card details are collected and processed by Stripe and are never received by us.
• Usage counts (generated by the Service): for each preset and day, the number of photos processed, flagged, or rejected. These counts contain no photo data.
• Support communications (from you): messages sent through Contact Support, together with your name and email, the team, role, and remaining photo balance, the website and preset selected, the page from which you wrote, and your browser's user-agent string.
• Security and service records (generated by the Service and Cloudflare): request logs recording the time, path (excluding query strings), status, duration, Cloudflare request identifier, and approximate country; and rate-limit counters keyed by one-way hashes of network addresses or accounts, which expire with their window (typically 10 to 60 minutes).
• Email records: sign-in codes and confirmation links are generated per request; we store only one-way hashes of codes, and links are signed rather than stored. If you delete your account after receiving free photos, we retain a keyed one-way digest of your email address solely to prevent the free photos being claimed again (see section 8).

We do not collect precise geolocation, government identifiers, financial account numbers, or any special category of personal data, and we do not purchase personal information from third parties.

We process personal information only for the purposes below. Where the GDPR applies, the legal basis for each purpose under Article 6(1) is stated.

Purpose	Legal basis
Providing the Service: accounts, teams, processing photos, Bulk Edit, the website editor, and the API	Performance of a contract (Art. 6(1)(b))
Selling photo packs, keeping balances, and sending receipts	Performance of a contract; compliance with legal obligations for financial and tax records (Art. 6(1)(c))
Sending service emails: sign-in codes, confirmation links, security notices, and links that confirm deletions	Performance of a contract; legitimate interests in account security (Art. 6(1)(f))
Security, fraud and abuse prevention, rate limiting, and preventing repeat claims of free photos	Legitimate interests in protecting the Service and its users
Responding to support requests and exercising or defending legal claims	Performance of a contract; legitimate interests
Understanding performance through aggregate statistics	Legitimate interests in operating and improving the Service
Telling you about changes to pricing, these terms, or this policy	Performance of a contract; compliance with legal obligations

We do not use personal information for advertising, cross-context behavioral advertising, or profiling, and we do not sell, rent, or trade it. Where we rely on legitimate interests, you may object as described in section 9.

The Service uses only strictly necessary cookies, which do not require consent under the ePrivacy Directive and equivalent laws: sessionid (keeps you signed in; set on sign-in), csrftoken (protects forms against cross-site request forgery), and messages (holds a one-time notice between pages). Cloudflare may set the strictly necessary security cookies __cf_bm or cf_clearance when assessing automated traffic.

The dashboard stores interface preferences, such as the sidebar state and that you have seen the cookie notice, in your browser's local storage; these never leave your device. The website editor that businesses embed sets no cookies.

We measure page views with Cloudflare Web Analytics, which sets no cookies, stores nothing on your device, and reports to us only aggregate figures (pages, referrers, browser, operating system, device type, approximate country, and load time).

Because we do not sell or share personal information or engage in cross-context behavioral advertising, browser signals such as Global Privacy Control are honored automatically: there is no sale or sharing to opt out of. We do not track you across other websites, so Do Not Track signals do not change how the Service behaves.

We disclose personal information only to the following recipients, and only as necessary for the purposes in section 4:

Recipient	What and why
Cloudflare, Inc. (United States)	Network delivery, TLS, attack and bot protection, email delivery, and cookieless analytics. Processes request metadata (IP address, URL, user agent, time) and the content of emails we send. Privacy policy.
Stripe, Inc. and its affiliates	Payment processing and invoicing. Receives your email, the pack purchased, the team's PhotoSnap Plus identifier, and the billing details you enter at checkout. Stripe acts as an independent controller for payment data. Privacy policy.
Our hosting provider	Hosts the servers and database that run the Service, under contract and only on our instructions.
Members of your teams	See the team's presets, websites, usage counts, photo balance, purchases, and invitations, including who made or sent each, and the names, emails, and roles of other members.
Successors	A buyer or successor in a merger, acquisition, or sale of assets, bound by the commitments in this policy.
Authorities and others where required	Courts, regulators, or law enforcement where required by law, or where necessary to protect the rights, safety, or property of users, the public, or PhotoSnap Plus.

Our service providers are bound by written contracts that restrict their use of personal information to providing services to us. We have not sold or "shared" (as defined in the CCPA) personal information in the past 12 months and do not do so, including personal information of consumers under 16.

The Service is operated from, and personal information is processed in, the United States, and Cloudflare may process request data in the data center nearest to you. Where we or our service providers transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum, together with supplementary measures where appropriate. You may request a copy of the relevant safeguards by contacting us through Contact Support in the dashboard.

• Photos: not retained; ZIP jobs as described in section 2 (24 hours at most).
• Account information: until you delete your account. Deletion (Settings › Delete Account, confirmed through a link sent to your email) immediately erases your account, email confirmation, team memberships, support messages, open invitations to your email address, and active sessions, and deletes any team of which you are the only member, with its presets, websites, jobs, purchases, and balance.
• Team records: presets, websites, usage counts, purchases, and balances belong to the team and are kept while the team exists. Where you leave a team that continues, records of purchases you made remain with that team, without your account, as required for its financial and tax records; your email is removed as its billing email.
• Free-photo digest: if your account received free photos, a keyed one-way digest of the email address that received them is kept, including after you change your email or delete your account, solely to prevent repeat claims. It cannot be reversed into your address.
• Unconfirmed accounts: may be deleted after 30 days.
• Recently seen website addresses: up to 30 days. Sign-in code requests: deleted one day after expiry. Expired invitations: deleted 7 days after expiry. Rate-limit counters: expire with their window.
• Support messages: until resolved and no longer needed to follow up, or until you delete your account or ask us to delete them.
• Request logs: rotated automatically by size and kept only briefly, as long as needed to operate and secure the Service, unless needed to investigate a specific security incident.
• Payment records held by Stripe: retained by Stripe as required by financial and tax laws.

We extend the following rights to every user, wherever located, in addition to any further rights under the laws described in sections 10 to 13:

• Access and portability: to obtain confirmation of whether we process your personal information and a copy of it in a structured, machine-readable format. Settings › Download My Data provides this immediately as a JSON file.
• Correction: to correct inaccurate information. You can change your email address and password in Settings (changes of email are confirmed through a link sent to the new address) and ask us to correct anything else, such as your name.
• Deletion: to have your personal information deleted. Settings › Delete Account does this once you confirm through a link sent to your email address, subject to the retention described in section 8.
• Objection and restriction: to object to processing based on legitimate interests, or to ask us to restrict processing while a request is considered.
• Withdrawal of consent: where processing is based on consent, to withdraw it at any time without affecting prior processing.

How to make a request. Use the tools in Settings, or contact us through Contact Support in the dashboard. To protect your information, we verify requests by acting only through your signed-in account or by confirming through the email address on the account, and we may ask for more information where necessary. An authorized agent may submit a request on your behalf with your signed permission; we may ask you to confirm the request directly.

Timing. We respond within one month (GDPR and UK GDPR) or 45 days (US state laws), extendable where the law permits, in which case we will tell you why.

Appeals. If we decline a request, we will explain why. You may appeal by replying to our decision; we will respond to an appeal within 45 days (60 days where the law allows) and explain the outcome. If you are not satisfied, you may contact your data protection authority or state attorney general.

Non-discrimination. We will not deny the Service, charge different prices, or provide a different quality of service because you exercised a privacy right.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies to our processing of your personal information as controller. You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21), and the right not to be subject to solely automated decisions with legal or similarly significant effects (Art. 22; see section 14). The legal bases on which we rely are set out in section 4.

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of an alleged infringement; in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first.

Providing account information is necessary to enter into the contract for the Service; without it, we cannot create an account.

This section is our notice at collection and privacy policy disclosure for California residents under the CCPA. In the preceding 12 months we have collected the following categories of personal information, from the sources described in section 3, for the business purposes described in section 4, and disclosed each for a business purpose only to the recipients in section 6:

Category (Cal. Civ. Code § 1798.140)	Examples	Retention
Identifiers	Name, email address, account and team IDs, IP address	Until account deletion; IP addresses in logs as in section 8
Customer records (§ 1798.80(e))	Name, email, billing email	Until account or team deletion
Commercial information	Photo packs purchased, balances	While the team exists
Internet or network activity	Request logs, pages viewed (aggregate), browser user agent in support messages	As in section 8
Geolocation data	Approximate country only, from Cloudflare	As in section 8
Audio, electronic, or visual information	Photos, processed transiently and not retained	Not retained; ZIP jobs up to 24 hours
Sensitive personal information	Account sign-in credentials (email with password)	Until account deletion

We use sensitive personal information only to provide the Service and for the other purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), so the right to limit its use does not apply. We do not sell or share personal information, have no actual knowledge of selling or sharing the information of consumers under 16, and do not use personal information to infer characteristics about consumers.

California residents have the right to know what personal information we collect, use, disclose, and the categories of sources and recipients; to delete it; to correct it; to opt out of its sale or sharing (which does not occur); to limit the use of sensitive personal information (which we do not use beyond permitted purposes); and not to be discriminated against for exercising these rights. Requests may be made as described in section 9.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes (Cal. Civ. Code § 1798.83).

Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, have rights to confirm whether we process their personal data and to access, correct, delete, and obtain a portable copy of it, and to opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in targeted advertising, sale, or such profiling. We honor these rights for all US residents as described in section 9, including the right to appeal a refusal.

Nevada residents may request that we not sell covered information; we do not sell it. Washington residents should note that we collect no consumer health data and no biometric identifiers (see section 14).

Canada: we process personal information in accordance with PIPEDA and applicable provincial laws, including Quebec's Law 25. You may access and correct your information and withdraw consent, subject to legal and contractual limits, and may complain to the Office of the Privacy Commissioner of Canada. Our privacy officer can be reached at us through Contact Support in the dashboard.

Brazil: under the LGPD you have the rights set out in Article 18, including confirmation, access, correction, anonymization or deletion, portability, information about sharing, and review of automated decisions, and may petition the ANPD.

Australia and New Zealand: we handle personal information consistently with the Australian Privacy Principles and the New Zealand Privacy Act 2020; you may complain to the OAIC or the Office of the Privacy Commissioner.

If you live elsewhere and local law grants you rights over your personal information, contact us and we will honor them.

To crop and check a photo, the Service locates faces and measures image properties such as position, size, sharpness, brightness, and whether a hat or more than one person is present. These measurements are used only for that photo, are returned with it, and are discarded with it. The Service does not create face templates, faceprints, or any measurement used to identify, recognize, or verify an individual, and therefore collects no biometric identifiers or biometric information within the meaning of the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, the Washington biometric privacy law, or "biometric data" processed to uniquely identify a person under Article 9 GDPR.

The Service's checks classify photos as ready, set aside, or failed. They assess a photo's suitability, not a person, and do not produce decisions with legal or similarly significant effects. Businesses using the Service must not rely on them as the sole basis for such a decision (see the Terms of Service).

When a business embeds the website editor or sends photos through the API, it determines the purposes of that processing and is the controller (or "business") for it, responsible for providing notice to and obtaining any consent required from the individuals concerned. PhotoSnap Plus processes those photos as its processor or service provider, solely to edit and return them as described in section 2, and retains only aggregate counts. We do not sell, share, retain, use, or disclose such information for any purpose other than providing the Service to that business, nor combine it with other personal information.

A Data Processing Addendum incorporating the Standard Contractual Clauses is available to business customers on request at us through Contact Support in the dashboard. Individuals with questions about a particular website should contact the business that operates it; we will assist that business in responding.

We maintain technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS with HSTS), one-way hashing of passwords and sign-in codes, encryption at rest of ZIP job photos, protection against cross-site request forgery and script injection, rate limiting, least-privilege access to production systems, and confirmation through a link sent to the account's email address before an account or team is deleted. We send security notices when an account's password, email address, or data download occurs.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours where the GDPR requires, and affected individuals and regulators without unreasonable delay as required by applicable law.

The Service is not directed to children, and accounts may be created only by adults (see the Terms of Service). We do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If we learn that we have, we will delete it; contact us through Contact Support in the dashboard. Schools, clubs, and employers may use the Service to edit photos of minors, for example for identification badges; they act as controller for those photos and are responsible for any parental consent the law requires. Such photos are processed transiently as described in section 2.

We may update this policy. We will revise the date above and, for material changes, notify account holders by email before the changes take effect. The history below records each version.

November 12, 2026

Rewritten with plain-English summaries beside each section; added support messages, legal bases, international transfers, the California, other US state, Canadian, Brazilian, and Australian notices, faces and automated checks, Download My Data, deleting your account (confirmed by email), and what deletion removes.

November 11, 2026

First version for PhotoSnap Plus.